FreeRDP Android Client EUVD-2026-106995

Exploitation requires the victim's FreeRDP Android client to establish an RDP session to an attacker-controlled or compromised server that negotiates the graphics pipeline (RDPGFX) channel; the malicious server then supplies unvalidated mappedWidth/mappedHeight in an RDPGFX_MAP_SURFACE_TO_WINDOW_PDU. LIMITING FACTORS: this is a server-to-client (reverse) attack, so the attacker cannot reach arbitrary victims - the user must be induced to connect to the malicious endpoint, and only the FreeRDP Android client (versions before 3.32.1) with graphics-pipeline/surface-to-window updates in use is affected. Impact is bounded to heap memory disclosure and client crashes; there is no code execution or write primitive described.

This is a client-side heap out-of-bounds read (CWE-125) in the FreeRDP Android client, triggered by a MALICIOUS RDP SERVER rather than by an inbound attacker - a key framing that lowers real-world urgency. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, score 6.9) rates it Medium with only VC:L (low confidentiality) and no integrity or availability impact, consistent with an information-disclosure/crash read primitive. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so all three exploitation-pressure signals point to LOW immediate risk. CONFLICT TO NOTE: the supplied 4.0 vector asserts UI:N, but the vulnerability can only be reached after the victim actively connects their Android client to an attacker-controlled or compromised RDP server - a required user action that in practice should be scored as user interaction and that materially limits mass exploitation; verify the UI metric with the vendor advisory (GHSA-262p-h989-vmpv). Likewise the vector records VA:N despite the description explicitly mentioning crashes, suggesting the availability impact was underscored. Net: a legitimate memory-disclosure bug worth patching, but not a widespread-exploitation emergency - far below a network-reachable, server-side unauthenticated RCE of the same CVSS band.

An attacker stands up (or compromises) an RDP server and lures an Android FreeRDP user into connecting to it - for example via a malicious connection file, phishing, or a hijacked corporate gateway. Once the client connects, the server sends a crafted RDPGFX_MAP_SURFACE_TO_WINDOW_PDU with oversized mappedWidth/mappedHeight values, causing android_UpdateWindowFromSurface to copy heap memory beyond the surface allocation, crashing the app or leaking adjacent heap contents back to the attacker. No public exploit identified at time of analysis.